NuGet包来源与签名治理（sources-签名-哈希）最佳实践

--- title: NuGet包来源与签名治理（sources-签名-哈希）最佳实践 keywords: - NuGet - sources - 签名 - 哈希 - 白名单 description: 对 NuGet 包来源与签名、哈希进行白名单与校验，确保 .NET 依赖链的完整与可信。 categories: - 文章资讯 - 编程技术 --- **实现示例** ```ts type NuDep = { id: string; version: string; source: string; sha256: string; sig?: { alg: 'RS256'; b64: string } } const allowHosts = new Set(['api.nuget.org','nuget.example.com']) function hex64(h: string): boolean { return /^[A-Fa-f0-9]{64}$/.test(h) } function b64(s: string): boolean { return /^[A-Za-z0-9+/=]+$/.test(s) } function validSource(u: string): boolean { try { const x = new URL(u); return x.protocol === 'https:' && allowHosts.has(x.host) } catch { return false } } function semverLike(v: string): boolean { return /^(\d+\.\d+\.\d+)(?:[-A-Za-z0-9_.]+)?$/.test(v) } function evaluate(list: NuDep[]): { ok: boolean; errors: string[] } { const errors: string[] = [] for (const d of list) { if (!d.id || !semverLike(d.version)) errors.push(`id:${d.id}`) if (!validSource(d.source)) errors.push(`source:${d.id}`) if (!hex64(d.sha256)) errors.push(`hash:${d.id}`) if (d.sig && (d.sig.alg !== 'RS256' || !b64(d.sig.b64))) errors.push(`sig:${d.id}`) } return { ok: errors.length === 0, errors } } ``` **审计与CI门禁** - 审计来源域与哈希/签名；异常阻断并回退。 - 变更需审批与归档，支持快速回溯。